oss-security mailing list - 2026/04

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2026/04

Mon	Tue	Wed	Thu	Fri	Sat	Sun
		¹ 5	² 10	³ 7	⁴	⁵
⁶ 4	⁷ 14	⁸ 14	⁹ 30	¹⁰ 15	¹¹ 11	¹² 7
¹³ 12	¹⁴ 9	¹⁵ 9	¹⁶ 12	¹⁷ 17	¹⁸ 5	¹⁹ 4
²⁰ 9	²¹ 6	²² 8	²³ 6	²⁴ 5	²⁵ 3	²⁶ 10
²⁷ 8	²⁸ 23	²⁹ 27	³⁰ 21

Messages by day:

April 1 (5 messages)

Re: [vim-security] Vim modeline bypass via various options affects Vim < 9.2.0276 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: Multiple vulnerabilities in AppArmor (Greg KH <greg@...ah.com>)
[vim-security] Path traversal issue with zip.vim and special crafted zip archives in Vim < v9.2.0280 (Christian Brabandt <cb@...bit.org>)
[CVE-2026-5271] Python install manager script aliases search path hijack (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 2 (10 messages)

FW: libinput Security Advisory: multiple security issues in libinput (Peter Hutterer <peter.hutterer@...-t.net>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Announce: OpenSSH 10.3 released (Damien Miller <djm@....openbsd.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Tianyu Chen <sweetyfish@...pin.org>)
[ANNOUNCE] ATS is vulnerable to HTTP requests with body (Masakazu Kitajo <maskit@...che.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Solar Designer <solar@...nwall.com>)
[libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Jens Jarl Nestén Hansen-Nord <jens@...ten.eu>)

April 3 (7 messages)

Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Rich Felker <dalias@...c.org>)
Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Rich Felker <dalias@...c.org>)
Re: Announce: OpenSSH 10.3 released (Agostino Sarubbo <ago@...too.org>)
Re: Announce: OpenSSH 10.3 released (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Re: Multiple vulnerabilities in AppArmor (Salvatore Bonaccorso <carnil@...ian.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)

April 6 (4 messages)

Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
Re: Announce: OpenSSH 10.3 released (Damien Miller <djm@...drot.org>)
CVE-2026-34197: Apache ActiveMQ Broker, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans ("Christopher L. Shannon" <cshannon@...che.o…)
CVE-2026-33227: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ Web: Improper Limitati… ("Christopher L. Shannon" <cshannon@...c…)

April 7 (14 messages)

Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)
Re: Announce: OpenSSH 10.3 released (Damien Miller <djm@...drot.org>)
Re: Announce: OpenSSH 10.3 released (Demi Marie Obenour <demiobenour@...il.com>)
libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
CVE-2026-35554: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition (Manikumar <manikumar@...che.org>)
CVE-2026-27314: Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass (Michael Semb Wever <mck@...che.org>)
CVE-2026-27315: Apache Cassandra: cqlsh history sensitive information leak (Michael Semb Wever <mck@...che.org>)
CASSANDRA-21202: CVE-2026-32588: Apache Cassandra: Authenticated DoS via ALTER ROLE Password Hashing (Michael Semb Wever <mck@...che.org>)
Django CVE-2026-3902, CVE-2026-4277, CVE-2026-4292, CVE-2026-33033, and CVE-2026-33034 (Jacob Walls <jwalls@...ngoproject.com>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.foundation>)
[OSSA-2026-005] Keystone: Restricted application credentials can create EC2 credentials (CVE-2026-33551) (Jeremy Stanley <fungi@...goth.org>)
[vim-security] Netbeans command injection in Vim < v9.2.0316 (Christian Brabandt <cb@...bit.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Christian Göttsche <cgoettsche@...tendoof.de>)

April 8 (14 messages)

systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminals (Aaron Rainbolt <arraybolt3@...eup.net>)
Multiple CVEs disclosed in CUPS (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Multiple CVEs disclosed in CUPS (Peter Gutmann <pgut001@...auckland.ac.nz>)
Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack (Solar Designer <solar@...nwall.com>)
Re: Axios Supply-Chain Attack [v1.14.1] [0.30.4] --> plain-crypto-js [4.2.0][4.2.1] (Solar Designer <solar@...nwall.com>)
CVE-2026-5082: Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-5083: Ado::Sessions versions through 0.935 for Perl generates insecure session ids (Robert Rothenberg <rrwo@...nsec.org>)
Re: [EXTERN] Re: Multiple CVEs disclosed in CUPS ("Schwedas, Sven" <Sven.Schwedas@...z.at>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's termina… (Aaron Rainbolt <arraybolt3@...eup.net>)
Re: Fwd: [siren] Severity: High – Potential Malicious Campaign Underway Targeting Open Source Developers via Slack (Stuart D Gathman <stuart@...hman.org>)
PyCA cryptography 46.0.7 released, fixes CVE-2026-39892 (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Re: Heads-up: Upcoming Samba security releases (2026-04-09) (Douglas Bagnall <dbagnall@...ba.org>)
Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 9 (30 messages)

X41 Advisory X41-2026-001: Guardrail Sandbox Escape in LiteLLM (Markus Vervier <markus.vervier@...-dsec.de>)
libpng 1.6.57: Use-after-free vulnerability fixed: CVE-2026-34757 (Cosmin Truta <ctruta@...il.com>)
4 security fixes in Flatpak, including critical CVE-2026-34078: Complete sandbox escape leading to host file access and code… (Solar Designer <solar@...nwall.com>)
lftp 4.9.3 does not filter non-printable characters in the output to the terminal (Vincent Lefevre <vincent@...c17.net>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Solar Designer <solar@...nwall.com>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Solar Designer <solar@...nwall.com>)
Re: 4 security fixes in Flatpak, including critical CVE-2026-34078: Complete sandbox escape leading to host file access and co… (Simon McVittie <smcv@...ian.org>)
CVE-2026-34538: Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure) (Rahul Vats <rahulvats@...che.org>)
CVE-2026-33005: Apache OpenMeetings: Insufficient checks in FileWebService (Maxim Solodovnik <solomax@...che.org>)
CVE-2026-33266: Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt (Maxim Solodovnik <solomax@...che.org>)
CVE-2026-34020: Apache OpenMeetings: Login Credentials Passed via GET Query Parameters (Maxim Solodovnik <solomax@...che.org>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's termin… (Salvatore Bonaccorso <carnil@...ian.org…)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue ("Andrew G. Morgan" <morgan@...nel.org>)
Re: libcap-2.77 (since libcap-2.04) has TOCTOU privilege escalation issue (Tianyu Chen <sweetyfish@...pin.org>)
CVE-2025-57735: Apache Airflow: Airflow Logout Not Invalidating JWT (Rahul Vats <rahulvats@...che.org>)
CVE-2026-39304: Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handlin… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-40046: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT: Missing fix for CVE-2025-66168: MQTT contro… ("Christopher L. Shannon" <cshannon@...c…)
Re: [libc musl] - Algorithmic complexity DoS in iconv GB18030 decoder (Jens Jarl Nestén Hansen-Nord <jens@...ten.eu>)
CVE-2026-24880: Apache Tomcat: Request smuggling via invalid chunk extension (Mark Thomas <markt@...che.org>)
CVE-2026-25854: Apache Tomcat: Occasionally open redirect (Mark Thomas <markt@...che.org>)
CVE-2026-29129: Apache Tomcat: TLS cipher order is not preserved (Mark Thomas <markt@...che.org>)
CVE-2026-29145: Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled (Mark Thomas <markt@...che.org>)
CVE-2026-29146: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default (Mark Thomas <markt@...che.org>)
CVE-2026-32990: Apache Tomcat: Fix for CVE-2025-66614 is incomplete (Mark Thomas <markt@...che.org>)
CVE-2026-34483: Apache Tomcat: Incomplete escaping of JSON access logs (Mark Thomas <markt@...che.org>)
CVE-2026-34486: Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor (Mark Thomas <markt@...che.org>)
CVE-2026-34487: Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token (Mark Thomas <markt@...che.org>)
CVE-2026-34500: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (Mark Thomas <markt@...che.org>)
[OSSA-2026-006] OpenStack Skyline: DOM-based XSS in Skyline Console via unsanitized instance console log rendering (CVE… (Goutham Pacha Ravi <gouthampravi@...il.…)

April 10 (15 messages)

Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminal… (Aaron Rainbolt <arraybolt3@...il.com>)
Re: X41 Advisory X41-2026-001: Guardrail Sandbox Escape in LiteLLM (Solar Designer <solar@...nwall.com>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Solar Designer <solar@...nwall.com>)
Re: systemd-journald in systemd 259 does not escape characters in emerg messages that are wall'd to other user's terminals (Vincent Lefevre <vincent@...c17.net>)
CVE-2026-4631 [cockpit] Unauthenticated remote code execution due to SSH command-line argument injection (Jelle van der Waa <jelle@...aa.nl>)
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verifi… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34479: Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidd… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-34481: Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTempla… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40021: Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbid… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40023: Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to un… (Piotr Karwasz <pkarwasz@...che.org>)
CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs (Rich Felker <dalias@...c.org>)
xdg-desktop-portal GHSA-rqr9-jwwf-wxgj: Trashing of arbitrary host files (Simon McVittie <smcv@...ian.org>)
xdg-dbus-proxy CVE-2026-34080: Eavesdrop filter bypass allows message interception (Simon McVittie <smcv@...ian.org>)

April 11 (11 messages)

CVE-2026-40198: Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass (Stig Palmquist <stig@...g.io>)
CVE-2026-40199: Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypas… (Stig Palmquist <stig@...g.io>)
[kubernetes] CVE-2026-3865: CSI Driver for SMB path traversal via subDir may delete unintended directories on the SMB s… (Vinayak Goyal <vinayakankugoyal@...il.c…)
CPython [CVE-2026-1502] HTTP client proxy tunnel headers not validated for CR/LF (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython [CVE-2026-3446] Base64 decoding stops at first padded quad by default (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior to 1.6.14 (Valtteri Vuorikoski <vuori@...com.org>)
Re: CVE-2026-35537+more: Roundcube arbitrary write + ID/XSS/etc. prior to 1.6.14 (Valtteri Vuorikoski <vuori@...com.org>)
LibRaw 0.22.1 Release with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Avahi: Reachable assertion in transport_flags_from_domain (CVE-2026-34933) (Alan Coopersmith <alan.coopersmith@...cle.com>)
GNU tar: listing/extraction desynchronization allows hidden file injection (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Collin Funk <collin.funk1@...il.com>)

April 12 (7 messages)

Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Solar Designer <solar@...nwall.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Collin Funk <collin.funk1@...il.com>)
Security Audit of Hex, the Erlang package manager (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: GNU tar: listing/extraction desynchronization allows hidden file injection (Paul Eggert <eggert@...ucla.edu>)
CVE-2026-35337: Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling (Richard Zowalla <rzo1@...che.org>)
CVE-2026-35565: Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI (Richard Zowalla <rzo1@...che.org>)

April 13 (12 messages)

Re: Security Audit of Hex, the Erlang package manager (Alexander Patrakov <patrakov@...il.com>)
CVE-2026-5085: Solstice::Session versions through 1440 for Perl generates session ids insecurely (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2025-54057: Apache SkyWalking: Stored XSS vulnerability (Zhenxu Ke <kezhenxu94@...che.org>)
CVE-2026-34476: Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server (Qiuxia Fan <qiuxiafan@...che.org>)
CVE-2026-34884: Apache SkyWalking MCP: SSRF via set_skywalking_url Tool and GraphQL Expression Injection in MCP Server (Qiuxia Fan <qiuxiafan@...che.org>)
CVE-2025-66236: Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI (Rahul Vats <rahulvats@...che.org>)
CVE-2026-33858: Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API (Rahul Vats <rahulvats@...che.org>)
CVE-2026-39816: Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService (David Handermann <exceptionfactory@...che.org>)
Re: Security Audit of Hex, the Erlang package manager (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2026-6100] CPython: Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use … (Alan Coopersmith <alan.coopersmith@...c…)
[CVE-2026-4786] CPython: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.… (Alan Coopersmith <alan.coopersmith@...c…)
CVE-2026-5086: Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks (Robert Rothenberg <rrwo@...nsec.org>)

April 14 (9 messages)

CVE-2026-31923: Apache APISIX: Openid-connect `tls_verify` field is disabled by default (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-31924: Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-31908: Apache APISIX: forward auth plugin allows header injection (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-33929: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code (Tilman Hausherr <tilman@...che.org>)
wolfSSL ML-DSA: same-process heap reuse exposes private signing material, enabling signature forgery (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
wolfSSL 5.9.1 CVE and non-CVE fixes (Solar Designer <solar@...nwall.com>)
[disclosure] Multiple unpatched CVEs in libav (unmaintained FFmpeg fork, last update 2019) (yangjincheng1998@...il.com)
Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Olivier Fourdan <ofourdan@...hat.com>)
[OSSA-2026-007] OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean (CVE PENDING) (Goutham Pacha Ravi <gouthampravi@...il.c…)

April 15 (9 messages)

CVE-2025-54550: Apache Airflow: RCE by race condition in example_xcom dag (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-30778: Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information… (Kai Wan <wankai@...che.org>)
CVE-2026-25219: Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users … (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-5088: Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts (Robert Rothenberg <rrwo@...nsec.org>)
Re: CVE-2026-5088: Apache::API::Password versions through v0.5.2 for Perl can generate insecure random values for salts (Jacques Deguest <jack@...uest.jp>)
[CVE-2026-5713] CPython: Out-of-bounds read/write during remote debugging when connecting to malicious target (Alan Coopersmith <alan.coopersmith@...cle.com>)
[vim-security] Command injection via backtick expansion in tag filenames in Vim < v9.2.0357 (Christian Brabandt <cb@...bit.org>)
7 vulnerabilities disclosed & patched in jq (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Fwd: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 16 (12 messages)

Re: 7 vulnerabilities disclosed & patched in jq (Collin Funk <collin.funk1@...il.com>)
UAF in rsync 3.4.1 and below (Przemyslaw Frasunek <przemyslaw@...sunek.com>)
cosmic-greeter: Unsafe File System Operations in User Home Directories (CVE-2026-25704) (Matthias Gerstner <mgerstner@...e.de>)
Re: UAF in rsync 3.4.1 and below (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-27363: FontForge affected by FreeType heap-buffer-overflow; upstream maintainer declines under Community-guidelines #D1 (yangjincheng1998@...il.com)
Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
CVE-2026-31987: Apache Airflow: JWT token appearing in logs (Rahul Vats <rahulvats@...che.org>)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: UAF in rsync 3.4.1 and below (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (Solar Designer <solar@...nwall.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)

April 17 (17 messages)

Re: Apache Kvrocks affected by CVE-2024-31449 and CVE-2025-49844 (Redis Lua); fixed but no formal advisory (yangjincheng1998@...il.com)
CVE-2026-33557: Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication (Luke Chen <showuon@...che.org>)
CVE-2026-33558: Apache Kafka, Apache Kafka Clients: Information Exposure Through Network Client Log Output (Luke Chen <showuon@...che.org>)
CVE-2025-66335: Apache Doris MCP Server: MCP SQL inject (Mingyu Chen <morningman@...che.org>)
CVE-2026-30912: Apache Airflow: Exposing stack trace in case of constraint error (Rahul Vats <rahulvats@...che.org>)
CVE-2026-32690: Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1 (Rahul Vats <rahulvats@...che.org>)
CVE-2026-30898: Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf (Rahul Vats <rahulvats@...che.org>)
CVE-2026-32228: Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to (Rahul Vats <rahulvats@...che.org>)
CVE-2026-25917: Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5) (Rahul Vats <rahulvats@...che.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Matthias Ferdinand <ml.oss-security@...dv.net>)
cups: 8 various moderate vulnerabilities (Zdenek Dohnal <zdohnal@...hat.com>)
ngtcp2: qlog_parameters_set_transport_params_stack_overflow [CVE-2026-40170] (Alan Coopersmith <alan.coopersmith@...cle.com>)
Xen Security Advisory 488 v1 - x86: Floating Point Divider State Sampling (Xen.org security team <security@....org>)
CVE-2026-40948: Apache Airflow Keycloak Provider: OAuth Login CSRF — Missing State Parameter in Keycloak Auth Manager (Jarek Potiuk <potiuk@...che.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Eli Schwartz <eschwartz@...too.org>)
lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (differen… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Sam James <sam@...too.org>)

April 18 (5 messages)

Re: lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (diff… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)
Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (Solar Designer <solar@...nwall.com>)
CVE-2026-41113: RCE in sagredo fork of qmail (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 19 (4 messages)

[CVE REQUEST] terminal-controller-mcp: trivially bypassable command blocklist enables unrestricted RCE (CVSS 10.0) (Pico 🧬 <pico@...al.dev>)
Re: [CVE REQUEST] terminal-controller-mcp: trivially bypassable command blocklist enables unrestricted RCE (CVSS 10.0) (Alan Coopersmith <alan.coopersmith@...c…)
Re: CVE-2025-27363: FontForge affected by FreeType heap-buffer-overflow; upstream maintainer declines under Community-guidelines #D… (Sam James <sam@...too.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Matthias Ferdinand <ml.oss-security@...dv.net>)

April 20 (9 messages)

Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Dimitri Ledkov <dimitri.ledkov@...inguard.dev>)
[ADVISORY] CVE-2026-5265: Heap Over-Read in ICMP Error Response Generation (Ales Musil <amusil@...hat.com>)
[ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing (Ales Musil <amusil@...hat.com>)
Re: [ADVISORY] CVE-2026-5265: Heap Over-Read in ICMP Error Response Generation (Ales Musil <amusil@...hat.com>)
Re: [ADVISORY] CVE-2026-5367: Heap over-read in OVN DHCPv6 Client ID processing (Ales Musil <amusil@...hat.com>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Morten Linderud <morten@...derud.pw>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Demi Marie Obenour <demiobenour@...il.com>)
Fwd: [CVE-2026-3219] pip doesn't reject concatenated ZIP and tar archives (Alan Coopersmith <alan.coopersmith@...cle.com>)
The GNU C Library security advisories update for 2026-04-20 (Carlos O'Donell <carlos@...hat.com>)

April 21 (6 messages)

Libgcrypt security releases 1.12.2, 1.11.3, 1.10.x (Valtteri Vuorikoski <vuori@...com.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Michael Orlitzky <michael@...itzky.com>)
Fwd: X.Org Security Advisory: CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() (Olivier Fourdan <ofourdan@...hat.com>)
CVE-2026-40706: ntfs-3g 2022.10.3: Heap buffer overflow (Rostislav <rostislav@...era.com>)
CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2025-15638: Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt (Robert Rothenberg <rrwo@...nsec.org>)

April 22 (8 messages)

Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Sam James <sam@...too.org>)
Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Sam James <sam@...too.org>)
Re: UAF in rsync 3.4.1 and below (Sam James <sam@...too.org>)
Re: Go 1.26.2 and Go 1.25.9 are released with 10 security fixes (Demi Marie Obenour <demiobenour@...il.com>)
[SECURITY] CVE-2026-40542: Apache HttpClient 5.6 SCRAM-SHA-256 mutual authentication bypass (Arturo Bernal <abernal@...che.org>)
CVE-2026-41651: TOCTOU vulnerability in PackageKit <= 1.3.4 leads to local root exploit (Matthias Klumpp <matthias@...stral.net>)
Re: CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow (Steffen Nurpmeso <steffen@...oden.eu>)
[vim-security] OS Command Injection in netrw affects Vim < 9.2.0383 (Christian Brabandt <cb@...bit.org>)

April 23 (6 messages)

PowerDNS Security Advisory 2026-03 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2026-41564: CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking (Stig Palmquist <stig@...g.io>)
PowerDNS Authoritative Server 4.9.14 and 5.0.4 released (Miod Vallat <miod.vallat@...erdns.com>)
CVE-2026-40466: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTT… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-41043: Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues ("Christopher L. Shannon" <cshannon@...ch…)
CVE-2026-41044: Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via De… ("Christopher L. Shannon" <cshannon@...c…)

April 24 (5 messages)

CVE-2026-23902: Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow exe… (Wenjun Ruan <wenjun@...che.org>)
CVE-2025-62233: Apache DolphinScheduler: Deserialization of untrusted data in RPC (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-38743: Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities (Rahul Vats <rahulvats@...che.org>)
CVE-2026-40690: Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all D… (Rahul Vats <rahulvats@...che.org>)
rust-openssl-v0.10.78 fixes 5 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 25 (3 messages)

bubblewrap CVE-2026-41163: Privilege escalation if setuid root, via ptrace (Simon McVittie <smcv@...ian.org>)
CVE-2026-40557: Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all… (Richard Zowalla <rzo1@...che.org>)
CVE-2026-41081: Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure (Richard Zowalla <rzo1@...che.org>)

April 26 (10 messages)

libexpat 2.8.0 fixes CVE-2026-41080 (insufficient entropy) (Sebastian Pipping <sebastian@...ping.org>)
CVE-2026-27172: Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code executio… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-33453: Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet … (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-33454: Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution vi… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-40022: Apache Camel: Camel-Platform-HTTP-Main: Authentication Bypass on Non-Root Context Paths in camel main r… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-40048: Apache Camel: Camel-PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-40453: Apache Camel: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sj… (Andrea Cosentino <acosentino@...che.org…)
CVE-2026-40473: Apache Camel: Camel-Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-40858: Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository (Andrea Cosentino <acosentino@...che.org>)
CVE-2026-40860: Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and cam… (Andrea Cosentino <acosentino@...che.org…)

April 27 (8 messages)

plasma-login-manager: Weaknesses in plasmaloginauthhelper (CVE-2026-25710) (Matthias Gerstner <mgerstner@...e.de>)
uriparser 1.0.1 fixes CVE-2026-42371 (integer overflow) (Sebastian Pipping <sebastian@...ping.org>)
CVE-2026-41409: Apache MINA: CWE-502 Deserialization of Untrusted Data (Emmanuel Lécharny <elecharny@...che.org>)
ZDRES-059: CVE-2026-41635: Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter … (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-7040: Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have heap overflow when processing some malfor… (Robert Rothenberg <rrwo@...nsec.org>)
[OSSA-2026-008] Ironic: Command Injection in IPMI Console Implementations (CVE pending) (Jay Faulkner <jay@....cc>)
[CVE-2026-6357] pip self-update functionality can import newly installed modules after wheel installation (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-40355, CVE-2026-40356: MIT krb5 1.18+ Unauthenticated Network read overrun and null pointer dereference (Cem Onat Karagun <cemkaragun@...il.com>)

April 28 (23 messages)

CVE-2026-41636: Apache Thrift: Node.js skip() recursion (Jens Geyer <jensg@...che.org>)
CVE-2026-41607: Apache Thrift: C++ JSON OOB read (Jens Geyer <jensg@...che.org>)
CVE-2026-41606: Apache Thrift: c_glib dispatch stack overflow (Jens Geyer <jensg@...che.org>)
CVE-2026-41605: Apache Thrift: Swift Compact Protocol integer overflow (Jens Geyer <jensg@...che.org>)
CVE-2026-41604: Apache Thrift: Swift Range crash in skip() (Jens Geyer <jensg@...che.org>)
CVE-2026-41602: Apache Thrift: Go TFramedTransport uint32 overflow (Jens Geyer <jensg@...che.org>)
CVE-2026-41603: Apache Thrift: Java TSSLTransportFactory hostname verification (Jens Geyer <jensg@...che.org>)
CVE-2025-48431: Apache Thrift glibc language bindings: Specially crafted input can crash a c_glib Thrift server with invalid poin… (Jens Geyer <jensg@...che.org>)
[CVE-2026-3087] shutil.unpack_archive() doesn't check for Windows absolute paths in ZIPs (Alan Coopersmith <alan.coopersmith@...cle.com>)
Xen Security Advisory 483 v2 (CVE-2026-23556) - oxenstored keeps quota related use counts across domain destruction (Xen.org security team <security@....org>)
Xen Security Advisory 484 v2 (CVE-2026-23557) - Xenstored DoS via XS_RESET_WATCHES command (Xen.org security team <security@....org>)
Xen Security Advisory 485 v2 (CVE-2026-31786) - Linux kernel out of bounds read via Xen-related sysfs file (Xen.org security team <security@....org>)
Xen Security Advisory 486 v2 (CVE-2026-23558) - grant table v2 race in status page mapping (Xen.org security team <security@....org>)
Xen Security Advisory 487 v2 (CVE-2026-31787) - Linux kernel double free in Xen privcmd driver (Xen.org security team <security@....org>)
Coordinated Disclosure in the LLM Age (Jeremy Stanley <fungi@...goth.org>)
The GNU C Library security advisories update for 2026-04-28 (Carlos O'Donell <carlos@...hat.com>)
CVE-2026-41873: Pony Mail: Admin account takeover via request smuggling (Arnout Engelen <engelen@...che.org>)
Xen Security Advisory 489 v1 (CVE-2026-23559,CVE-2026-23560,CVE-2026-23561,CVE-2026-23562,CVE-2026-42486) - Multiple RB… (Xen.org security team <security@....org…)
Re: Coordinated Disclosure in the LLM Age (Greg Dahlman <dahlman@...il.com>)
[SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (MOHAMED AZIZ RAHMOUNI <mohamedaziz.rahmouni@...at.ucar.tn>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Dmitry Butskoy <buc@....spb.ru>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Dmitry Butskoy <buc@....spb.ru>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Alan Coopersmith <alan.coopersmith@...cle.com>)

April 29 (27 messages)

CVE-2026-40560: Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence (Timothy Legge <timlegge@...nsec.org>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Ellenor Bjornsdottir <ellenor/securesoftware@...rellix.net>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Solar Designer <solar@...nwall.com>)
Re: Coordinated Disclosure in the LLM Age (Jacob Bachmeyer <jcb62281@...il.com>)
Re: [SECURITY] Out-of-Bounds Read in MPLS Extension Parsing — traceroute 2.1.2 (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Coordinated Disclosure in the LLM Age (Peter Gutmann <pgut001@...auckland.ac.nz>)
[ADVISORY] curl: CVE-2026-4873: connection reuse ignores TLS requirement (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-5545: wrong reuse of HTTP Negotiate connection (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-5773: wrong reuse of SMB connection (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-6429: netrc credential leak with reused proxy connection (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-6253: proxy credentials leak over redirect-to proxy (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-7009: OCSP stapling bypass with Apple SecTrust (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-6276: stale custom cookie host causes cookie leak (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-7168: cross-proxy Digest auth state leak (Daniel Stenberg <daniel@...x.se>)
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: Coordinated Disclosure in the LLM Age (Lucas Holt <luke@...lishgames.com>)
CVE-2026-7111: Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argumen… (Stig Palmquist <stig@...g.io>)
Xen Security Advisory 489 v2 (CVE-2026-23559,CVE-2026-23560,CVE-2026-23561,CVE-2026-23562,CVE-2026-42486) - Multiple RB… (Xen.org security team <security@....org…)
Re: Coordinated Disclosure in the LLM Age (Jeremy Stanley <fungi@...goth.org>)
Re: Coordinated Disclosure in the LLM Age (Willy Tarreau <w@....eu>)
Re: Coordinated Disclosure in the LLM Age (Renaud Allard <renaud@...ard.it>)
Re: Coordinated Disclosure in the LLM Age (Clemens Lang <cllang@...hat.com>)
CVE-2026-31431: CopyFail: linux local privilege scalation (Jan Schaumann <jschauma@...meister.org>)
Re: Coordinated Disclosure in the LLM Age (Brian May <brian@...uxpenguins.xyz>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Eddie Chapman <eddie@...k.net>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Sam James <sam@...too.org>)
CVE-2026-7381: Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting (Robert Rothenberg <rrwo@...nsec.org>)

April 30 (21 messages)

OSSA-2026-008: OpenStack Ironic: Command Injection in Ironic IPMI Console Implementations (CVE-2026-42510) - errata 1 (Goutham Pacha Ravi <gouthampravi@...il.c…)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Zube <Zube@...ix.com>)
gnutls 3.8.13 released with 12 CVE fixes and more (Alan Coopersmith <alan.coopersmith@...cle.com>)
inetutils-2.8 released with 2 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Aaron Rainbolt <arraybolt3@...il.com>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Solar Designer <solar@...nwall.com>)
[CVE-2026-37555] libsndfile IMA-ADPCM integer overflow (incomplete fix for CVE-2022-33065) (Feng Ning <feng@...ora.ai>)
Re: lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (diff… (Abhinav Agarwal <abhinavagarwal1996@gma…)
Re: lcms2 <= 2.18 CubeSize() integer overflow: stock Ubuntu 24.04 Poppler / evince-thumbnailer / OpenJDK crashers (different trigge… (Sam James <sam@...too.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Sam James <sam@...too.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Greg KH <greg@...ah.com>)
Re: Coordinated Disclosure in the LLM Age (Greg KH <greg@...ah.com>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (cyber security <cs7778503@...il.com>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Eric Biggers <ebiggers@...nel.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Sam James <sam@...too.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Greg KH <greg@...ah.com>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Roman Medina-Heigl Hernandez <roman@...labs.com>)
CVE-2026-5080: Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely (Robert Rothenberg <rrwo@...nsec.org>)
Re: CVE-2026-31431: CopyFail: linux local privilege scalation (Alan Coopersmith <alan.coopersmith@...cle.com>)
Exim 4.99.2 fixes 4 CVEs (Solar Designer <solar@...nwall.com>)

311 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.